CVE-2023-38671
HighCVSS 8.3Exploitation Probability (EPSS)
Low risk46th percentile - higher than 46% of all known CVEs
Summary
Heap buffer overflow in paddle.trace in PaddlePaddle before version 2.5.0. This flaw can lead to denial of service, information disclosure, or more damage is possible.
Risk Assessment
This vulnerability poses a risk to organizations as it can lead to system downtime and potential data leakage.
Recommendation
It is recommended to update PaddlePaddle to version 2.5.0 or later to mitigate the risks associated with this vulnerability.
Other vulnerabilities in PaddlePaddle
See all- CVE-2023-38673Critical
PaddlePaddle before 2.5.0 has a command injection in fs.py, allowing for the execution of arbitrary commands on the operating system.
- CVE-2023-38672Medium
There is an FPE vulnerability in paddle.trace in PaddlePaddle before version 2.5.0, which can lead to runtime crashes and denial of service.
- CVE-2023-38670Medium
A null pointer dereference in paddle.flip in PaddlePaddle before version 2.5.0 results in a runtime crash and denial of service.
- CVE-2023-38669High
There is a use after free vulnerability in paddle.diagonal in PaddlePaddle before version 2.5.0, leading to a potentially exploitable condition.
Original NVD description (English source)
Heap buffer overflow in paddle.trace in PaddlePaddle before 2.5.0. This flaw can lead to a denial of service, information disclosure, or more damage is possible.